This privacy policy is intended to inform you about the types of your personal data (hereinafter also referred to briefly as "data") we process, for what purposes, and to what extent. The privacy policy applies to all data processing activities we carry out, both in the context of providing our services and, in particular, on our websites, in mobile applications, and within external online presences, such as our social media profiles (hereinafter collectively referred to as the "online offering").
The terms used are not gender-specific.
As of: January 28, 2024
Florian Zandberg
Am Schwarzen Berg 131
21682 Stade
https://foodlog.life/imprint.html
The following overview summarizes the types of data processed and the purposes of their processing, and refers to the data subjects.
Relevant legal bases under the GDPR: Below, we provide you with an overview of the legal bases of the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations may apply in your or our home country or in the country where we are based.
National data protection regulations in Germany: In addition to the data protection regulations of the General Data Protection Regulation, national regulations on data protection apply in Germany. These include, in particular, the Act on Protection against Misuse of Personal Data in Data Processing (Federal Data Protection Act - BDSG). In particular, the BDSG contains special provisions on the right to access, the right to erase, the right to object, the processing of special categories of personal data, processing for other purposes, processing for purposes of scientific or historical research purposes or for statistical purposes, and the duties of the data protection officer. Furthermore, it regulates data processing for the purposes of the employment relationship (Section 26 BDSG), in particular with regard to the establishment, implementation, or termination of employment relationships as well as consent (Section 26 (2) BDSG) in connection with the provision of health services (Section 22 BDSG), with regard to social services (Section 67 BDSG), and in other areas.
We take appropriate technical and organizational measures to ensure a level of protection appropriate to the risk, in accordance with legal requirements, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons.
The measures include, in particular, safeguarding the confidentiality, integrity, and availability of data by controlling physical access to the data, as well as the access, input, disclosure, availability, and separation of data. We have also set up procedures to ensure the exercise of data subjects' rights, the deletion of data, and the response to data breaches. Furthermore, we take the protection of personal data into account as early as the development or selection of hardware, software, and processes, in accordance with the principle of data protection by design and by default.
In the context of our processing of personal data, it may be necessary to transfer data to other places, companies, or persons, including to recipients located in countries outside the European Union (EU) or the European Economic Area (EEA) (hereinafter referred to as "third countries").
The transfer of data to third countries is carried out either when it is required by law, when it is necessary for the fulfillment of a contract, or when we have obtained consent from the data subjects.
Subject to legal or contractual permissions, we process or allow the data to be processed in a third country only if the special requirements of Art. 44 ff. GDPR are met. This means that processing is carried out, for example, on the basis of special guarantees, such as the officially recognized determination of a level of data protection corresponding to that of the EU (e.g., for the USA by the "Privacy Shield") or compliance with officially recognized special contractual obligations (so-called "standard contractual clauses").
If we process data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) or if this occurs in the context of the use of third-party services or disclosure or transfer of data to third parties, this will only take place if it occurs for the fulfillment of our (pre)contractual obligations, on the basis of your consent, on the basis of a legal obligation, or on the basis of our legitimate interests.
Subject to legal or contractual permissions, we process or allow the data to be processed in a third country only if the special requirements of Art. 44 ff. GDPR are met. This means that processing is carried out, for example, on the basis of special guarantees, such as the officially recognized determination of a level of data protection corresponding to that of the EU (e.g., for the USA by the "Privacy Shield") or compliance with officially recognized special contractual obligations (so-called "standard contractual clauses").
For residents of Canada: The personal information you provide to us may be transferred to and stored on servers in the United States and may be accessible to U.S. law enforcement and authorities in accordance with applicable U.S. laws.
For residents outside the United States: Please note that the personal information you submit to us may be transferred to and stored on servers located outside your home country, and you consent to the transfer, storage, and processing of such information outside of your home country.
If data is transferred to third countries, this is done on the basis of Art. 44 et seq. GDPR, in particular on the basis of contractual arrangements such as the standard contractual clauses. Information on this can be provided on request.
Any data subject affected by the transfer of data to third countries has the right to obtain information about the appropriate guarantees in connection with the transfer.
We use the application programming interface (API) provided by the US-based company OpenAI for our app. The service provider is OpenAI OpCo, LLC, 3180 18th Street, San Francisco, CA, USA.
What is OpenAI?
OpenAI specializes in the development of artificial intelligence (AI) and machine learning. The company was founded by a group of researchers and technology entrepreneurs. The two most well-known founder names are probably Sam Altman and Elon Musk. OpenAI's mission is to advance the development of AI systems while ensuring that the technology also has societal benefits. The most well-known product of OpenAI is ChatGPT, but the company also offers other products that we access through the API interface.
We use services from OpenAI in our app to provide you with a better and more interactive user experience. With the help of OpenAI tools, you can directly interact with your own input data and, for example, analyze your diary.
Processed Data
The data stored depends on your inputs. All inputs made in the selected period in the diary are processed when you start an analysis. We explicitly notify you before any transmission to OpenAI. No data is transferred without your consent. In general, OpenAI processes natural language, images, and other data formats that can be used to create machine learning models. This data is used to improve or train the capabilities of the respective tool. When you use OpenAI products, your IP address is processed. However, in general, if you do not enter personal data, they will not be processed or stored (except for the IP address). All input data is anonymized and encrypted for maximum privacy protection. The tool also does not use cookies to store and process data without your consent. The input data is used exclusively to improve the quality of the AI results.
Here is an overview of the most common data collected by OpenAI products:
Duration of Data Storage
Generally, the input data remains stored at OpenAI because the tools use the corresponding data to train themselves. However, there is also a function with which we can deactivate the transmitted data so that the data cannot be used for training purposes. We have activated this function so that ChatGPT or OpenAI only stores your data for 30 days after collection or input by you.
Data Deletion or Prevention of Data Storage
Under the data protection law of the European Union, you have the right to access, update, delete, or restrict your data. However, you can only prevent complete data processing by not using OpenAI products.
Legal Basis for Processing Personal Data
If personal data is collected, the use of OpenAI products requires consent. According to Art. 6 para. 1 lit. a GDPR (consent), this consent is the legal basis for the processing of personal data by OpenAI products.
In addition to consent, we have a legitimate interest in optimizing our service and thus improving our offering technically and economically. With the help of OpenAI products, we improve your user experience in our app. The legal basis for this is Art. 6 para. 1 lit. f GDPR (legitimate interests).
OpenAI processes your data, among other places, in the USA. We would like to point out that, according to the opinion of the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA. This can be associated with various risks for the legality and security of data processing.
As the basis for data processing for recipients based in third countries (outside the European Union, Iceland, Liechtenstein, Norway, especially in the USA) or for data transfers to them, OpenAI uses so-called standard contractual clauses (= Art. 46. Abs. 2 and 3 GDPR). Standard contractual clauses (Standard Contractual Clauses – SCC) are model templates provided by the EU Commission and are intended to ensure that your data is processed in accordance with European data protection standards even when transferred and stored in third countries (such as the USA). Through these clauses, OpenAI undertakes to comply with European data protection standards when processing your personal data, even if the data is stored, managed, or otherwise processed in the USA. These clauses are based on an implementing decision of the EU Commission (Implementing Decision (EU) 2021/914 of the Commission of 4 June 2021). You can find the decision and the corresponding standard contractual clauses, among other places, here:
https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de
We hope we have provided you with the most important information about the data processing by OpenAI. You can learn more about data processing by OpenAI in the privacy policy here:
https://openai.com/policies/privacy-policyThe data processed by us will be deleted in accordance with legal requirements as soon as the consents allowing processing are revoked or other permissions are no longer valid (e.g., if the purpose of processing this data has ceased to exist or they are no longer required for the purpose). If the data is not deleted because it is necessary for other and legally permissible purposes, its processing will be restricted to these purposes. This means that the data will be blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons or whose storage is necessary for the assertion, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person. Our privacy policy may also contain further information on the storage and deletion of data that primarily apply to the respective processing.
Rights of data subjects under the GDPR: As data subjects, you have various rights under the GDPR, in particular, arising from Articles 15 to 21 of the GDPR:
We process the data of users to be able to provide them with our online services. For this purpose, we process the IP address of the user, which is necessary to transmit the contents and functions of our online services to the user's browser or device.
Further Information on Processing Procedures, Procedures, and Services:
We use Firestore to securely store the data generated when using our apps. Without data storage, all user and profile data would be lost. Data storage is therefore necessary for the functionality of our apps. Furthermore, the storage of user data serves to prevent fraud and manipulation attempts by third parties. The functionality of the service, its further development, and ensuring the integrity and security of our information technology systems are legitimate interests within the meaning of Art. 6(1)(f) GDPR. Therefore, the processing in the form of storage is carried out with a legal basis.
The privacy policy of Google can be found by users at https://www.google.com/policies/privacy/
When contacting us (e.g., by mail, contact form, email, phone, or via social media) as well as in the context of existing user and business relationships, the information of the inquiring individuals is processed as far as necessary to answer the contact inquiries and any requested measures.
Further information on processing procedures, procedures, and services:
With the consent of users, we can send users so-called "push notifications." These are messages that are displayed on the screens, devices, or browsers of users, even when our online service is not actively being used.
To sign up for push notifications, users must confirm the request of their browser or device to receive push notifications. This consent process is documented and stored. Storage is necessary to determine whether users have consented to receive push notifications and to be able to prove the consent. For these purposes, a pseudonymous identifier of the browser (so-called "push token") or the device ID of an end device is stored.
Contents:"Reminder of a set medication"
Our settings and unsubscribe options:"You can adjust or unsubscribe from our push notifications in the "Settings" section of your mobile phone."
We kindly ask you to regularly inform yourself about the content of our privacy policy. We adjust the privacy policy as soon as changes in the data processing carried out by us make this necessary. We will inform you as soon as the changes require your cooperation (e.g., consent) or any other individual notification.
If we provide addresses and contact information of companies and organizations in this privacy policy, please note that the addresses may change over time, and we ask you to check the information before contacting them.
In this section, you will find an overview of the terminology used in this privacy policy. Where the terms are legally defined, their legal definitions apply. The following explanations are primarily intended for understanding.